Tigers vs Lions: Towards Characterizing 
Solitary and Group User Behavior in MMORPG 



Juhoon Kim*^, Nikolaos Chatzis*^ Matthias Siebke 1 ", Anja Feldmann*^ 
^Technische Universitat Berlin, Telekom Innovation Laboratories 
{jkim,nikolaos,anja}@net.t-labs.tu-berlin.de*^, siebke.matthias@gmail.com^ 



m 
o 

IX, 



<S1 

(J 



> 

o 
o 

o 



x 



Abstract — The development of Internet technologies enables 
software developers to build virtual worlds such as Massively 
Multi-Player Online Role-Playing Games (MMORPGs). The 
population of such games shows super-linear growing tendency. 
It is estimated that the number of Internet users subscribed in 
MMORPGs is more than 22 million worldwide [1]. However, 
only little is known about the characteristics of traffic generated 
by such games as well as the behavior of their subscribers. 
In this paper, we characterize the traffic behavior of World 
of Warcraft, the most subscribed MMORPG in the world, by 
analyzing Internet traffic data sets collected from a European 
tier-1 ISP in two different time periods. We find that World of 
Warcraft is an influential application regarding the time spent by 
users (1.76 and 4.17 Hours/day on average in our measurement), 
while its traffic share is comparatively low (< 1 %). In this 
respect, we look at the World of Warcraft subscriber's gaming 
behavior by categorizing them into two different types of users 
(solitary users and group users) and compare these two groups 
in relation to the playing behavior (duration as the metric) and 
the in-game behavior (distance as the metric). 

I. Introduction 

Ever since the personal computer was introduced game 
developers have been building virtual worlds. While the hard- 
ware resources, e. g., CPU/GPU power and memory capacity, 
have been the key constraints on developing such games in the 
past, network resources and properties, e.g., bandwidth and 
latency, play an important role in today's online games. Given 
the fact that the number of Massively Multi-player Online Role 
Playing Game (MMORPG) subscribers rapidly increases every 
year and that it reached 22 million in 201 1 [1], it is crucial for 
ISPs to understand characteristics of Internet traffic generated 
by MMORPGs and the playing behavior of their users. 

According to several reports (see for instance [2], [1]), World 
of Warcraft (a.k.a. WoW) alone accounts for more than 50 % 
of the total MMORPG subscriptions. Thereby, this particular 
online game has attracted much attention of academia and 
industry. 

In this paper, we present the analysis of MMORPG traffic 
and users' gaming behavior focusing on World of Warcraft as 
a representative game. The contributions of our paper are 
mainly three-fold. First, we reveal the characteristics of World 
of Warcraft game traffic by thoroughly analyzing Internet traffic 
collected from a European tier-1 ISP. Second, we present 
changes of traffic behavior by observing two data sets collected 
in different time periods. Third, we compare the gaming 
behavior of users who play the game alone and users who play 
the game together with other users behind the same middle 



box. As far as we know, none of the previous studies [3], [4], 
[5], [6], [7] questioned on the theme (the user behavior of 
MMORPGs) from this perspective. 

The remainder of this paper is structured as follows. Sec- 
tion II provides the necessary background for understanding 
World of Warcraft. We discuss related work in Section III. 
The implementation of our protocol analyzer is discussed 
in Section IV and traffic traces used for this study are described 
in Section V. Section VI and Section VII explore characteris- 
tics of World of Warcraft traffic and World of Warcraft subscriber's 
gaming patterns, respectively. Finally, we conclude the paper 
in Section VIII. 

II. Overview of World of Warcraft 

World of Warcraft was first introduced in the market by 
Blizzard Entertainment in 2004 and soon became one of the 
most subscribed (the number of its worldwide subscriptions 
reached 12 million in October 2010 [2]) online games. A 
user 1 within World of Warcraft is represented as a graphical form, 
which is often called the avatar, whose identity (name, gender 
etc.) is usually different from the user's real world identity. 
This type of game is commonly referred to as a Massively 
Multi-player Online Role Playing Game (MMORPG). 

Unlike traditional computer games, in which the user plays 
as the only intellectual game entity and the other entities act 
based on the story line programmed by the game developers, 
MMORPGs provide their subscribers virtual worlds in which 
users meet and communicate with other users. This makes 
interactions among users to play more important role than 
the story line. For MMORPGs, more than a thousand users 
play the game at the same time and they build the real-world- 
like society in the game world. Moreover, users own private 
possessions and even trade them with other users in virtual 
world currency. These sorts of social features allow MMORPG 
providers to introduce a different business model from that 
of traditional games. While users pay for the purchase of 
traditional computer games, MMORPG users pay fee based 
on time they play. 

Although World of Warcraft is designed to accommodate a 
massive number of players, it needs a certain level of load 
balancing. To this end, Blizzard Entertainment provides mul- 
tiple copies of the virtual world for their users, which are 
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"subscriber", and "player" are interchangeably used in 



called realms. Thus, avatars are only able to interact with the 
other avatars which are within the same realm. 

III. Related Work 

Previous studies in MMORPGs have mainly focused either 
on characterizing gaming traffic behavior [8], [9], [10] or on 
determining the users' playing patterns [3], [4], [5], [6], [7]. 
Although some of our findings overlap studies of the former 
category, we emphasize that our work falls more into the latter 
category as the novelty of our findings mainly lies on the 
gaming behavior analysis of solitary users and group users. 

Szabo et al. [6] studies how gaming traffic is influenced 
by various in-game activities of game players by deeply 
inspecting MMORPG traffic. Suznjevic et al. [10] evaluates 
types of actions generated by players within the virtual world. 
Their work aims at determining activities of players within 
the game world, while our work examines properties such 
as the movement of avatars within the virtual world and 
the playing duration of users. Cevizci et al. [8] studies self- 
similarity of online game traffic, but they do not particularly 
focus on MMORPGs. Kihl et al. [3] reports that 20% of 
the households in their measurement environment (a Swedish 
broadband access network with 12K users) has active World 
of Warcraft players and that their average playing duration is 
2.3 hours per day. Our work is complementary to their work 
since we perform our measurement based on the traffic traces 
collected from the topologically similar network in 2008 and 
2010, while they conduct the measurement on traffic collected 
in 2009. 

Chen et al. [9] analyzes ShenZhou online game traffic 
collected at the server side and reports that MMORPG traffic 
shows irregularities due to the players' drastically diverse 
gaming behaviors. However, our results suggest that there is a 
high level of similarity when grouping players by the number 
of co-players behind the same middle box (i. e., residential 
gateways). Varvello et al. [7] studies avatars' social behavior 
in Second Life. They find that approximately 0.3 % of the total 
subscribers are playing the game concurrently at any point of 
time and that they do not move 90 % of the connected time. 
They also find that avatars in Second Life tend to organize 
small groups (2 to 10 avatars). Some of these numbers are 
noticeably different in our study. This is likely due to the 
different gaming nature between Second Life and World of 
Warcraft. Pittman et al. [5] studies the population dynamics of 
virtual worlds over time and the players' movement patterns 
in the virtual world. Miller et al. [4] analyzes the avatars' 
movements within the virtual world and they find that 5 % 
of visited territory accounts for 30% of all time spent. 
We also consider the movement as an important metric for 
characterizing the player's in-game behavior, but we focus 
rather on the distance avatars travel than on the pattern of the 
movement. Benevenuto et al. [11] studies the user's interaction 
with other online users within various social networks (i. e., 
Orkut, MySpace, Hi5, Linkedln). Although their study is based 
on online social networks, the key question asked in their work 
and the one in our work are similar to each other. 



IV. Methodology 

In this section, we describe the implementation of the 
analysis tool and the classification method used to perform our 
measurement. Note that we are willing to offer our anlaysis 
tool to other researchers for further studies on this subject (see 
also Section V). 

A. Analysis Tool 

For our analysis, we implement the World of Warcraft protocol 
analyzer with Bro NIDS [12] as the code base. The reason 
why we choose Bro as the basis of our analysis tool is mainly 
due to three unique features of Bro. First, Bro is designed 
in such a way that the transport layer protocol analyzers 
are hierarchically separated from the higher layer protocol 
analyzers, so that developers do not need to deal with the 
complexity that transport layer protocols have (e.g., TCP 
stream re-assembly). Second, Bro supports a specialized proto- 
col analyzer development framework which can be translated 
by the BinPac protocol parser generator [13]. The development 
process is greatly eased due to the framework. Third, Bro 
provides an indigenous protocol identification mechanism, 
namely the Dynamic Protocol Detection (DPD) [14], which 
allows the analyzer to identify the protocol in the semantic 
manner. More precisely, the analyzer identifies a potential 
protocol in the beginning of the connection based on various 
classification methods (e. g., signature or well-known network 
ports) then confirms or denies the decision depending on 
the connection's further behavior. This unique feature of Bro 
improves the accuracy of the traffic classification. 

B. Classification Method 

In order to illustrate our classification method in detail, we 
first provide some level of technical information about the 
World of Warcraft protocol. The World of Warcraft protocol uses 
TCP as its transport protocol and a client typically opens 
two connections towards different servers. One connection is 
established between the client and the logon server in order to 
authenticate the subscriber and to update relevant server/client 
information such as the list of game servers and the status 
of the subscriber's avatar. The other connection is established 
between the client and the game server in which actual gaming 
information, e. g., coordinates of the avatar and chat messages, 
is exchanged. 

Our analyzer is implemented to detect the protocol in two 
steps. The initial step of the protocol identification is based 
on examining the protocol's unique byte pattern (signature) of 
the first packet of the connection. We use "\x00 . . . WoW and 
" . . \xed\x01 as regular expression signatures of the logon 
connection and the game connection, respectively. However, 
due to the short signature length, relying only on this step 
yields a high false-positive rate. Thus, the next step verifies 
if the connection responder replies with the expected signa- 
tures. In this step, we use "\x00 (logon connection) and 
" . . \xec\x01 (game connection) as signatures. 

Even after the protocol classification, the nature of the pro- 
prietary software that the World of Warcraft programs have and 



partly encrypted protocol messages make the deep inspection 
of World of Warcraft traffic extremely difficult. Thus, we use 
unencrypted part of protocol messages for our analysis. As 
we will show in Section VI, more than 60% of the World 
of Warcraft packets are coordinate information which can be 
translated into human readable text. 

V. Data Sets 

We use two anonymized 24-hour packet-level traffic data 
sets (ISP08 and ISP10) for our study. These two traces are 
collected at the same aggregation point within a European 
tier-1 ISP in 2008 and in 2010. The monitor, using Endace 
monitoring cards, operates at the broadband access router 
connecting customers to the ISP's backbone. We count more 
than 20K DSL lines behind our vantage point. All confiden- 
tial information such as IP address and user identification 
are anonymized by Bro's integrated encryption feature. The 
relevant information of our traffic data sets and the number of 
identified World of Warcraft subscribers are summarized in Ta- 
ble I. 

In the light of the fact that World of Warcraft traffic is 
pure controlling traffic generated by users (e.g., by mouse 
button clicking and/or by key pressing), as opposed to the 
media content delivery, we believe that 0.48 % and 0.72 % 
(see Table I) of traffic contributions are worthwhile to study. 
Note that traffic generated by software updates is not included. 

Although our traffic data is highly anonymized, we cannot 
make it publicly available since the content of messages 
encrypted by the World of Warcraft application is unknown 
to us and may include personal information. However, the 
measurement can be conducted by using any such traces since 
our analysis tool is available 2 to public under the same license 
that Bro NIDS follows (BSD). 

VI. Traffic Characteristics 

In this section, we first illustrate the general characteristics 
of World of Warcraft traffic. Then, we present that the majority 
of the World of Warcraft traffic is movement messages in which 
coordinates of avatars and nearby objects (e. g., non-player 
characters or game items) are delivered. 

A. General Characteristics 

Figure 1, Figure 2, and Figure 3 respectively depict the 
distributions of packet size (payload only), packet sending 
rate, and throughput. We report results of logon connections 
separately from those of data connections since those two 
types of connections show clearly different behavior in terms 
of packet count, traffic volume, and duration of connections. 
Interestingly, we observe that the line shape of server-to-client 
packet streams of ISP10 is significantly different from that 
of ISP08 in all logon plots, while the change of client-to- 
server packet streams is not remarkable. Furthermore, the lines 
representing data packet streams of ISP10 ((b) of all three 

2 The base code can be downloaded from http://www.bro-ids.org/ and our 
analysis tool can be obtained by contacting the corresponding author of this 
paper. 



figures) have drastically shifted compared to those of ISP08. 
We draw the conclusion that the protocol has been modified 
during the two years in such ways that a server delivers logon 
information in a more compressed or more distributed manner 
and delivers gaming information more frequently. 

Comparing the throughput statistics of the two traces shown 
in Figure 3, the later version of World of Warcraft protocol tends 
to need more bandwidth than the earlier one. Yet, its bandwidth 
utilization is relatively low considering the network bandwidth 
provided by today's ISPs. This means, unlike popular belief 
among users, upgrading the link capacity may not be the 
solution for a better gaming experience. 

B. Movement Messages 

Regarding the peak of client-to-server packet streams ob- 
served in Figure 1 (b), 43 bytes (ISP08) and 51 bytes (ISP10) 
are typical sizes identified from packets which deliver avatar's 
coordinates within the virtual world to the server. The reason 
why the size of the movement message differs in two traces is 
that the object's ID is embedded in a different way in different 
versions of the protocol. This phenomenon leads us to the 
conclusion that more than 60 % of the total packets delivered 
from clients to servers is the avatar's coordinate information. 

By deeply inspecting server-to-client messages, we find that 
the majority of messages sent from servers to clients are 
movement messages for updating the client on coordinates of 
its nearby players and objects. However, we do not observe the 
peak which is shown in client-to-server packet streams since a 
server sends coordinates of various numbers of objects within 
one packet. 

VII. Tigers vs Lions 

MMORPG subscriber's gaming behavior is an often ad- 
dressed research topic in online game traffic measurement. 
Such studies are especially important for ISPs in order to 
understand user's increasing demand for a good gaming 
experience. Assuming MMORPG users as a homogeneous 
group, previous studies [9], [3], [4], [10], [6] focus either 
on characterizing the overall gaming behavior of users or 
on comparing the user behavior in different virtual worlds. 
However, towards gaining a more complete insight into the 
gaming behavior of MMORPG subscribers we take a different 
approach to those of earlier work. 

A. Playing Behavior 

We first classify World of Warcraft players into two groups. 
The first group consists of users who is the only player behind 
an IP address. The other group consists of users whose IP 
addresses are shared with other World of Warcraft users. We refer 
to the former as Tigers and to the latter as Lions according to 
their hunting behaviors (tigers hunt individually, while lions 
hunt in a pride). One must note that players may be included in 
both groups multiple times due to the change of their playing 
locations or the reallocation of IP addresses, thus the number 
of users reported in Table II is greater than the one in Table I. 
It is crucial to mention that we do not focus on characteristics 



TABLE I: Overview of anonymized packet traces. 





Overall Traffic 


World of Warcraft 


Name 


Mon. Year 


Duration 


Volume 


packets 


Volume 


Version 


Users 


Avg. Playing 


ISP08 


Aug. 2008 


12:00 - 12:00 


> 4TB 


0.91 % 


0.48 % 


2.4.3 


3.0 % (599) 


1.76 Hours 


ISP10 


Mar. 2010 


02:00 - 02:00 


> 4TB 


0.83 % 


0.72 % 


3.x.y 


1.4% (280) 


4.17 Hours 
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Fig. 1: Packet size 
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Fig. 2: Packet rate 




ISP08/Logon (C->S) 
ISPlO/Logon (C->S) 
ISPlO/Logon (S->C) 
<- ISPOS/Logon (S->C) 

10 100 IK L0K 

Throughput (in bytes/s) 
(a) Logon connections 




Throughput (in bytes/s) 
(b) Data connections 

Fig. 3: Throughput 



TABLE II: Categorization of users according to the number of locally grouped co-players 



Group size 
(in players) 


ISP08 


ISP10 


# of IPs. 


# of users 


volume 


# of IPs 


# of users 


volume 


Tigers 


1 


487 (75 %) 


487 (54 %) 


53% 


257 (82 %) 


257 (68 %) 


65% 




2 


118 (18%) 


236 (26 %) 


28% 


46 (15%) 


92 (24 %) 


30% 


Lions 


3 


26 (4%) 


78 (9%) 


10% 


8 (3 %) 


24 (6 %) 


> 4% 




4 


11 (2%) 


44 (5 %) 


< 6% 


1 «1%) 


4 (1 %) 


< 1 % 




> 4 * 


7 (<2%) 


55 (6%) 


< 4% 


(0 %) 


(0 %) 


0% 




total 


649 (100%) 


900 (100%) 


100% 


312 (100%) 


377 (100%) 


100% 


* Maximum number of users behind a single IP address is 14 



of individual users, but intend to study general differences 
between locally grouped players and solitary players in terms 
of playing time, traffic volume, and distance their avatars move 
within the virtual world. We summarize relevant statistics in 
Table II. 

With few exceptions in ISP08, we find that the number of 
users per group of Lions is less than 4 which is a common max- 
imum number of physical network ports on home networking 
devices. The table explains that the fraction of Tigers increases 
in ISP10. 

Figure 4 illustrates the subscriber's playing time in different 



perspectives. While Figure 4 (a) depicts duration of connec- 
tions, the result shown in Figure 4 (b) is aggregated with the 
user. We infer two observations from the figures. First, while 
the number of identified game users decreases during the 
two years, the playing duration tends to increase. Taking a 
deeper look, we find that the fraction of users who play 
the game shorter than 0.28 hours in a day decreases from 
40 % to 20 %, while the fraction of users who play the 
game longer than 2.8 hours in a day increases from 20% to 
40 %. Second, considering that the y-axis of Figure 4 (b) is in 
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Fig. 4: Playing time distributions 
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a logarithmic scale, solitary users (Tigers) are playing notably 
longer than users playing together behind the same middle box 
(Lions). 

In Figure 4 (c), we illustrate the time of day that users play 
the game. Note that the y-axis of this figure represents World 
of Warcraft users and x-axis time of day. Each time slot is filled 
with various depth of gray color depending on the minutes 
played in the time slot. Thus, a time slot is fully used when 
it is black and it is not used when it is white. The x-axis is 
wrapped around the beginning time of the measurements. It is 
crucial to illustrate the results in this manner in order to make 
the results comparable. Indeed, the two traces do not begin at 
the same time of day and also do not begin at mid night (see 
Table I). The sudden bright cells observed between 11 a.m. 
and 1 p.m. in ISP10 is due to the fact that the connections 
established before the beginning of the measurement cannot 
be recognized by the analyzer. The figure suggests that there 
is only a negligible difference between Tigers and Lions when 
considering the time of day they play. Unsurprisingly, popular 
time slots of a day are identified between 7 p.m. and 1 1 p.m. 

B. In-game Behavior 

Next, we analyze the distance that avatars move in the 
virtual world during the game play. Figure 5 illustrates the 
distance distribution of the avatar's movement. As there is no 
way to map the distance in the virtual world to the real world's 
metric, we invent an imaginary metric Wm for measuring the 
distance in World of Warcraft. In order to provide readers with 
the intuitional hint of this virtual metric, we illustrate the 
distribution of the speed at which avatars move in the virtual 
world in Figure 6. In this analysis, we find that about 0.8 % 
of the identified avatars has unrealistic movement speeds (two 
to three orders of magnitude higher speed than the average 
speed). We assume that these are mainly due to the usage of 
long distance transportation systems such as the teleport. We, 
thus, ignore such extremely high movements from the result. 
From this evaluation, it is calculated that average speeds of 
avatars are 4.25 Wm/s (ISP08) and 6.39 Wra/s (ISP10). Figure 5 
illustrates that Lions show more itinerant behavior than Tigers. 
This is likely due to the fact that Tigers spend more time 
for communicating with other avatars in the virtual world, 



whereas Lions focus more on hunting in the battle field. This 
is a reasonable inference because, for Lions, a communication 
with other users does not interfere in the movement in the 
virtual world as their in-game friends are within the talking 
distance. 
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VIII. Conclusions 

In this paper, we have presented a thorough analysis of 
World of Warcraft game traffic based on two sets of anonymized 
packet-level traces collected from a European tier-1 ISP in two 



different time periods. This study is intended to provide ISPs 
and academia for a better understanding of MMORPG user 
behavior and characteristics of network traffic generated by 
such games. For this study, we developed the protocol analyzer 
designed to identify World of Warcraft traffic from the overall 
Internet traffic and to extract unencrypted messages, i. e., logon 
messages and movement messages, from the classified World 
of Warcraft traffic. 

From this analysis, we uncover general trends and char- 
acteristics of World of Warcraft traffic. More precisely, we find 
that the protocol is modified during the two years (2008 to 
2010) in such a way that servers send less information or 
more compressed information to clients through the logon 
connections, and servers and clients send more information 
or more detailed information to each other through game 
connections. We also report that the bandwidth utilization of 
such games is comparatively low and more than 60 % of the 
total packets that clients send to the server are for updating the 
avatar's coordinates. Then, we examine differences between 
solitary users (Tigers) and users who play the game together 
with other users behind the same middle box (Lions). We find 
that Tigers tend to play the game longer than Lions, while Lions 
travel longer distance in the virtual world than Tigers. 

The major restriction we have encountered during this study 
is highly encrypted part of the payload. We are of the belief 
that we can find similarities among the same type of users 
if we examine social interactions, e.g., chatting and trading, 
between users. However, we do not intend to violate the 
privacy of World of Warcraft subscribers. Thus, our future work 
includes the development of the message classification method 
that identifies messages without the payload inspection. Fur- 
thermore, we plan to carry out a survey in the user community 
for finding out reasons of such differences between the two 
groups. 
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